<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: whs</title><link>https://news.ycombinator.com/user?id=whs</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Tue, 07 Apr 2026 11:53:53 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=whs" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by whs in "How kernel anti-cheats work"]]></title><description><![CDATA[
<p>I wish that is an option. Nowadays many non competitives games that you play with friends you trust still use EAC (yet accept non-kernel mode operation on Linux). I suppose other than VAC you can't buy a usermode anticheat middleware now.</p>
]]></description><pubDate>Sun, 15 Mar 2026 06:00:06 +0000</pubDate><link>https://news.ycombinator.com/item?id=47384711</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=47384711</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47384711</guid></item><item><title><![CDATA[New comment by whs in "Anthropic officially bans using subscription auth for third party use"]]></title><description><![CDATA[
<p>The analogy I like to use when people say "I paid" is that you can't pay for a buffet then get all the food take-home for free.</p>
]]></description><pubDate>Thu, 19 Feb 2026 11:54:55 +0000</pubDate><link>https://news.ycombinator.com/item?id=47072870</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=47072870</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47072870</guid></item><item><title><![CDATA[New comment by whs in "gRPC: From service definition to wire format"]]></title><description><![CDATA[
<p>I wrote gRPC xDS server for Kubernetes that is configuration-free. Basically just load xDS client library into your code, then use xds:///servicename.namespace (unlike DNS, namespace is always required). It should be as lightweight and scales in similar way to the cluster DNS.<p>My company run this exact code in production since it was created in 2022. We probably have several times more than 1000 rps gRPC requests running internally including over the public internet for hybrid cloud connectivity. That being said, gRPC's xDS client is not always bugs-free.<p><a href="https://github.com/wongnai/xds" rel="nofollow">https://github.com/wongnai/xds</a></p>
]]></description><pubDate>Sat, 14 Feb 2026 07:41:37 +0000</pubDate><link>https://news.ycombinator.com/item?id=47012510</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=47012510</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47012510</guid></item><item><title><![CDATA[New comment by whs in "I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded"]]></title><description><![CDATA[
<p>I think we ended up in this situation because of this outsourcing. Competitive games and MMO need comprehensive security solution, as cheating has a global lasting impact in matchmaking. Attackers may also have financial motivation to attack the anti cheat in these games.<p>Coop games might don't need as much security as competitive games, as some games do not have global state, or the global state is simply cosmetics. Since nowadays all the anticheat you can buy (except VAC) are kernel mode you'll have to accept the security risk just to have fun with your friends.</p>
]]></description><pubDate>Fri, 06 Feb 2026 17:27:50 +0000</pubDate><link>https://news.ycombinator.com/item?id=46915630</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=46915630</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46915630</guid></item><item><title><![CDATA[New comment by whs in "Updates to our web search products and  Programmable Search Engine capabilities"]]></title><description><![CDATA[
<p>I tried it and contributed to searx. It didn't give the same result as Google, and it also have 10k request rate limit (per month I believe). More than that you'll have to "contact us"</p>
]]></description><pubDate>Fri, 23 Jan 2026 12:27:48 +0000</pubDate><link>https://news.ycombinator.com/item?id=46731678</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=46731678</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46731678</guid></item><item><title><![CDATA[New comment by whs in "Threat actors expand abuse of Microsoft Visual Studio Code"]]></title><description><![CDATA[
<p>It should tell me what should I look before I trust it. Not trusting the workspace means I might as well use Notepad to open it. I wouldn't think that tasks.json include autorun tasks in addition to build actions.</p>
]]></description><pubDate>Thu, 22 Jan 2026 04:16:00 +0000</pubDate><link>https://news.ycombinator.com/item?id=46715252</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=46715252</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46715252</guid></item><item><title><![CDATA[New comment by whs in "RTS for Agents"]]></title><description><![CDATA[
<p>Other people have described Factorio-style game, or idle RPGs. I think for a Factorio-style game, Desynced might be a better programming game. I haven't play it for quite some time, but last I remember it has a visual editor and automation bots in early tech tree. In Factorio, if you craft a green circuit board it automatically craft all the precursors from iron/copper plates in your inventory. In Desynced you have to do all that manually, which force you to use the automation system right up front. However, it's not fun repeating code blocks to build different simple things, and it's not fun that you have to solve both gaming problems (eg. I need to build my base, what should I build next) and programming problems (eg. write flood fill bot to explore for resources) at the same time.<p>The problem with these kinds of game is at some point you'll run into tech debts - your factory layout is not optimal, and the game optimize your starting zone so migrating out means you may lose simple access to starting resources. I tried optimizing for large factory up front, but it's like a startup with a monolith running on a Kubernetes.<p>Satisfactory solved this by having a fixed map and 3D, but it comes with its own challenges. Good Company partially solved this by replacing belts with humans who can walk anywhere you want, and introduce belt at a late game stage (which I quit around that stage - the game already gets repetitive by that point).<p>Anyway, what I was describing was not those kind of automation games. RuneScape is an RPG game with over 20+ skills. What make it interesting is that RuneScape bot engines (which exists, but is illegal) do provide all the high level primitives for you in Java. You could provide a world coordinate and a walking script will do all the walk for you even if it is the other side of the world map. It should felt like making games in Scratch instead of reinventing serialization in Screeps.<p>Other games with scripting also often don't allow human-in-the-loop. If a bot in an automation game get stuck because you forgot to program how to restock teleports, you have to stop it and reprogram. RuneScape bots don't block inputs - if you forgot to make the bot handle stamina exhaustion just click the run button yourself without stopping the script.<p>RuneScape also comes with strategizing for the human, while the solution space is quite fixed and well discussed by the community if you don't want to find out yourselves. If your Slayer task is green dragons, do you go to a spot that is far from a bank and lose efficiency or give up the loot, or do you go to PvP zone and use cannon (multi target auto turret)? If I write a bot, I probably will write a Wildy Green Dragon script instead of a generic fight-anything script so that it will know to bring cannon and place it at the optimal spot to target all spawns at once. Same goes for many other skills - if I train crafting or construction do I sink millions and go for the highest XP rate or do I go very slowly and get a slight profit out of it.<p>I'd also add that having a community marketplace would also helps. RuneScape have underground marketplace for bots, with free scripts that probably get you banned, and paid "private" scripts that supposedly undetected. I also have played Mars First Logistics where you build a vehicle Lego-style, then deliver weird cargo like a block of ice or a crate of oranges without a lid. The game have Steam Workshop support where you can just skip building your own vehicle and try to drive someone else's vehicle to destination. I got an ice block pusher, which I need to figure out how to put the ice in (just surround the block, close gate so the block cannot escape), then the map has hills that make your ice fall over the bottom anyway.</p>
]]></description><pubDate>Wed, 21 Jan 2026 19:04:11 +0000</pubDate><link>https://news.ycombinator.com/item?id=46709987</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=46709987</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46709987</guid></item><item><title><![CDATA[New comment by whs in "Waiting for dawn in search: Search index, Google rulings and impact on Kagi"]]></title><description><![CDATA[
<p>>Google: Google does not offer a public search API. The only available path is an ad-syndication bundle with no changes to result presentation - the model Startpage uses. Ad syndication is a non-starter for Kagi’s ad-free subscription model.[^1]<p>>Because direct licensing isn’t available to us on compatible terms, we - like many others - use third-party API providers for SERP-style results (SERP meaning search engine results page). These providers serve major enterprises (according to their websites) including Nvidia, Adobe, Samsung, Stanford, DeepMind, Uber, and the United Nations.<p>The customer list matches what is listed on SerpAPI's page (interestingly, DeepMind is on Kagi's list while they're a Google company...). I suppose Kagi needs to pen this because if SerpAPI shuts down they may lose access to Google, but they may already have utilize multiple providers. In the past, Kagi employees have said that they have access to Google API, but it seems that it was not the case?<p>As a customer, the major implication of this is that even if Kagi's privacy policy says they try to not log your queries, it is sent to Google and still subject to Google's consumer privacy policy. Even if it is anonymized, your queries can still end up contributing to Google Trends.</p>
]]></description><pubDate>Wed, 21 Jan 2026 17:36:41 +0000</pubDate><link>https://news.ycombinator.com/item?id=46708775</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=46708775</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46708775</guid></item><item><title><![CDATA[New comment by whs in "RTS for Agents"]]></title><description><![CDATA[
<p>I wish there's a RuneScape server for bots. A game where it is both fun to play manually, and automated. Quests, for example, is a one-off thing where it could be fun for the player and not really useful to automate since it is a one-off task (unless you're running bot farm).<p>I don't think the main game would encourage that - the more obscure the protocol, the less bot in the actual game (even though I don't think it's hard to find protocol documentation or just plug into an official client). OpenRSC, a revival of RuneScape Classic do have botting worlds, but personally RSC is not "fun" for me.<p>There are programmer games like Screeps (which the new Arena version just launched at the end of last year), but those game usually do not allow manual play or only indirect play. I tried Screeps, but I'm not good at strategy games, so once I get the runtime working I lose interest and none of my friend would want to help me strategize in game that they do not understand.</p>
]]></description><pubDate>Wed, 21 Jan 2026 14:40:58 +0000</pubDate><link>https://news.ycombinator.com/item?id=46706344</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=46706344</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46706344</guid></item><item><title><![CDATA[New comment by whs in "Anthropic bans xAI from using Claude in Cursor"]]></title><description><![CDATA[
<p>The same news is reported at <a href="https://news.ycombinator.com/item?id=46562949">https://news.ycombinator.com/item?id=46562949</a><p>I don't think this is related to third-party use of CC. This is the same blocking as Anthropic blocking OpenAI access to CC <a href="https://www.wired.com/story/anthropic-revokes-openais-access-to-claude/" rel="nofollow">https://www.wired.com/story/anthropic-revokes-openais-access...</a> , which I think is fair that they don't want to help competitors.</p>
]]></description><pubDate>Mon, 12 Jan 2026 08:16:05 +0000</pubDate><link>https://news.ycombinator.com/item?id=46585523</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=46585523</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46585523</guid></item><item><title><![CDATA[New comment by whs in "Latest SteamOS Beta Now Includes Ntsync Kernel Driver"]]></title><description><![CDATA[
<p>Decky warns that the Steam's built in browser is outdated and may have security vulnerability. I suppose properly maintaining a browser is a burden.</p>
]]></description><pubDate>Sat, 10 Jan 2026 11:26:40 +0000</pubDate><link>https://news.ycombinator.com/item?id=46564782</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=46564782</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46564782</guid></item><item><title><![CDATA[New comment by whs in "Anthropic blocks third-party use of Claude Code subscriptions"]]></title><description><![CDATA[
<p>Copilot in VSCode is integrated with VSCode's LLM provider API. Which means that any plugins that needs LLM capabilities can submit request to Copilot. Roo Code support that as an option. And of course, there's a plugin that start an OpenAI/Anthropic-compatible web server inside VSCode that just calls to the LLM provider API. It seems that if you use unlimited models (like GPT-4.1) you probably get unlimited API calls. However, those model doesn't seems to be very agentic when used in Claude Code.</p>
]]></description><pubDate>Fri, 09 Jan 2026 18:57:33 +0000</pubDate><link>https://news.ycombinator.com/item?id=46557609</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=46557609</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46557609</guid></item><item><title><![CDATA[New comment by whs in "The Vietnam government has banned rooted phones from using any banking app"]]></title><description><![CDATA[
<p>Thai banks are required by regulation to have facial recognition when transferring over 50k THB in one transaction or cumulative in a day. I believe most banks have shutdown their internet banking as it's not worth it for the low number of users to implement web-based secure facial recognition that don't allow you to feed spoofed video input. One of the bank that I use will send a push notification to their mobile app for you to confirm the transaction.<p>I believe that previously internet banking, even before mobile banking, will limit the number of transfer recipients you can add per day/month. With the rise of QR payment I could see this limit being regularly hit if you scrape the web-based banking.<p>Since the Bank of Thailand claims that they technically don't block many things (mobile banking technical requirements seems to also require blocking root, but they never banned internet banking), I wish there's a new bank that try to disrupt the existing players. But the latest "branchless" banking license were only acquired by existing banking groups, so API-first personal banking remain impossible.</p>
]]></description><pubDate>Fri, 09 Jan 2026 17:49:02 +0000</pubDate><link>https://news.ycombinator.com/item?id=46556653</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=46556653</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46556653</guid></item><item><title><![CDATA[New comment by whs in "Vietnam bans unskippable ads"]]></title><description><![CDATA[
<p>In Thailand signs are taxed based on its size, text language (Thai only, No text or multilingual text and Thai text are placed lower than other languages, Multilingual text), and static/dynamic (I assume this applies to both digital and trivision).<p>This also not only for advertising but also normal signs like the logo of the business on buildings. You'll see most people circumvent the more expensive multilingual rate by adding small Thai text at the top of the sign.<p>Unrelated, but another interesting fact is that some bus stops in Bangkok are completely funded by an advertising company. Of course, they'll get the ads space for free as a result, and they only offer it in viable locations. The current governor doesn't like this idea and settle for a less fancy bus stop paid by public money.</p>
]]></description><pubDate>Wed, 07 Jan 2026 07:13:09 +0000</pubDate><link>https://news.ycombinator.com/item?id=46523486</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=46523486</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46523486</guid></item><item><title><![CDATA[New comment by whs in "Cloudflare outage on December 5, 2025"]]></title><description><![CDATA[
<p>I got curious and I checked AWS WAF. Apparently AWS WAF default limit for CloudFront is 16KB and max is 64KB.</p>
]]></description><pubDate>Fri, 05 Dec 2025 18:19:20 +0000</pubDate><link>https://news.ycombinator.com/item?id=46165088</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=46165088</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46165088</guid></item><item><title><![CDATA[New comment by whs in "Don't Download Apps"]]></title><description><![CDATA[
<p>On an unrooted Android you could use App Ops to do some of that with Shizuku.<p>I assume they don't expose it to users because once most people start to do that apps would start to implement detections, like if it spoof your location to a certain area then that area will get you "permission denied" error anyway, or I believe some apps do check that if your contact book is empty it assume you didn't give the permissions. It'd become a lot of work to implement a convincing spoof for most permissions to be blocked.</p>
]]></description><pubDate>Thu, 27 Nov 2025 16:13:45 +0000</pubDate><link>https://news.ycombinator.com/item?id=46070613</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=46070613</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46070613</guid></item><item><title><![CDATA[New comment by whs in "Google Antigravity"]]></title><description><![CDATA[
<p>You mean Android Studio will be canned in 2018 max with a reasonable estimate of 2016-2017?</p>
]]></description><pubDate>Tue, 18 Nov 2025 16:19:48 +0000</pubDate><link>https://news.ycombinator.com/item?id=45968251</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=45968251</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45968251</guid></item><item><title><![CDATA[New comment by whs in "Nearly 90% of Windows Games Now Run on Linux"]]></title><description><![CDATA[
<p>Some anticheats like EAC, GameGuard, XingCode do have Linux support that the game has to opt-in. I believe it is not kernel-based and is not Linux-native. Many non-competitive games do allow them.<p>At least I know that Helldivers 2 (GameGuard), DJMax Respect V (XingCode), Fantasy Life I (EAC) do works on Linux.<p>I wish that if they're happy with non kernel mode anti cheat on Linux, just do the same in Windows... Or just disable them if I don't use public matchmaking</p>
]]></description><pubDate>Wed, 29 Oct 2025 03:00:17 +0000</pubDate><link>https://news.ycombinator.com/item?id=45742141</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=45742141</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45742141</guid></item><item><title><![CDATA[New comment by whs in "I switched from Htmx to Datastar"]]></title><description><![CDATA[
<p>Try the EC2 creation page. There are tabs for advanced options, widgets like images selection that you can choose from AWS-managed, Community, your own AMI, etc. And then the next page is confirmation of similar widget which you can go back and edit. I'd imagine that if you render it in backend first and one of the tabs has error your backend form library has to know how to rerender all the widgets that you already implement in JavaScript once. If the page is done in SPA the backend just send the data back and the existing frontend widget just have to rehydrate itself.</p>
]]></description><pubDate>Sat, 11 Oct 2025 03:30:20 +0000</pubDate><link>https://news.ycombinator.com/item?id=45546374</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=45546374</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45546374</guid></item><item><title><![CDATA[New comment by whs in "I switched from Htmx to Datastar"]]></title><description><![CDATA[
<p>I think Datastar back when I was learning web programming and the dawn of AJAX would be Xajax [1]. I didn't even learn JavaScript back then because Xajax would generate a JS shim that you could call to trigger server side functions, and the function replace page fragments with new, server-generated content.<p>[1] <a href="https://github.com/Xajax/Xajax" rel="nofollow">https://github.com/Xajax/Xajax</a><p>While htmx reminds me of Adobe Spry Data [2] enough that I did a research into htmx and realize that Spry Data's equivalent is a htmx plugin and htmx itself is more similar to Basecamp's Hotwire. I assume there should be a late 2000 era AJAX library that do something similar to htmx, but I didn't use one as jQuery is easy enough anyway.<p>[2] <a href="https://opensource.adobe.com/Spry/articles/spry_primer/index.html" rel="nofollow">https://opensource.adobe.com/Spry/articles/spry_primer/index...</a><p>Anyway as other commenters has said, the idea of htmx is basically for some common use cases that you used jQuery, you might as well use no JavaScript at all to achieve the same tasks. But that is not possible today, so think of htmx as a polyfill for future HTML features.<p>Personally I still believe in progressive enhancements (a website should work 100% without JavaScript, but you'll lose all the syntactic sugar - for example Hashcash-style proof of work captcha may just give you the inputs and you'll have to do the exact same proof of work manually then submit the form), but I've yet to see any library that is able to offer that with complex interface, without code duplication at all. (Maybe ASP.NET can do that but I don't like the somewhat commercialized .NET ecosystem)<p>The UI I think would require React is a wizard-style form with clientside rendered widgets (eg. tabs). If you can't download a library to implement that, it is a lot of work to implement it on backend especially in modern websites where your session is now JWT instead of $_SESSION that requires a shared global session storage engine. I'd imagine that if you don't use React when the user go back to the tabbed page you'd need to either implement tab switching code on the backend side as well, or cheat and emit a JS code to switch the active tab to whatever the backend wants.</p>
]]></description><pubDate>Fri, 10 Oct 2025 18:05:52 +0000</pubDate><link>https://news.ycombinator.com/item?id=45541935</link><dc:creator>whs</dc:creator><comments>https://news.ycombinator.com/item?id=45541935</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45541935</guid></item></channel></rss>